skill-installer

Install a community skill from a watched registry. Reads the allowlist first, fetches, shows the RAW SKILL.md (not just a summary), runs structural trust checks, runs skills-qa, and only writes files after explicit user approval. Use when the user says "install [skill]", picks install from browse, or provides a direct skill URL.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced security install workflow with strong validation gates and real, well-signaled references. Its weaknesses are redundancy across the summary/Purpose/limits sections and a long monolithic body that keeps detailed material inline rather than splitting it into reference files.

Suggestions

Remove the restated mitigations from "A note on the limits of AI-mediated trust" and the top summary; reference the detailed Workflow steps instead to cut the redundancy flagged by conciseness.

Move the freshness preamble template and the install-log field schema into a reference file (e.g. references/freshness.md or references/install-log.md) and link from the Workflow, so SKILL.md reads as an overview.

Collapse the Step 1 license-gate prose blocks into a compact table of (mode, condition, action) to preserve actionability while reducing length.

Dimension	Reasoning	Score
Conciseness	The content is specific rather than padded with general knowledge, but the top 7-step summary, the "Purpose" section, and "A note on the limits of AI-mediated trust" restate the same three mitigations (read-only subagent, raw display, human approval) already detailed in the Workflow — it could be tightened. Not a 1 because it does not explain concepts Claude already knows; not a 3 because the repetition is avoidable.	2 / 3
Actionability	It supplies exact paths, a fixed SPDX list, specific regexes, verbatim prompt strings, a fillable preamble template, and concrete install-log field specs — fully executable and copy-paste ready.	3 / 3
Workflow Clarity	An 8-step (plus 5.5) sequenced workflow with explicit validation gates (allowlist, license, trust check, skills-qa verdict, role routing, approval) and feedback loops (refuse/flag/re-validate) matches the clear-sequence-with-checkpoints anchor.	3 / 3
Progressive Disclosure	The two references (allowlist.md, freshness.md) are real, one level deep, and clearly signaled, but the 505-line SKILL.md is largely monolithic — the freshness preamble template, license-gate procedure, and install-log schema are inline material that could be split into reference files. Not a 1 because references are well signaled and real; not a 3 because content is not appropriately split.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, specific, and gives explicit natural-language triggers covering both what the skill does and when to use it. It matches the high-quality examples in the rubric with no over-claims or fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Reads the allowlist first, fetches, shows the RAW SKILL.md, runs structural trust checks, runs skills-qa, and only writes files after explicit user approval" — matching the multi-action anchor rather than the single-domain score-2 example.	3 / 3
Completeness	It answers both what (the gate sequence) and when (explicit "Use when..." clause), which is the score-3 anchor; a score of 2 would require the when to be missing or only implied.	3 / 3
Trigger Term Quality	"Use when the user says 'install [skill]', picks install from browse, or provides a direct skill URL" gives natural phrases a user would actually say, not technical jargon, so it clears the good-coverage bar.	3 / 3
Distinctiveness Conflict Risk	"Install a community skill from a watched registry" with its allowlist/trust-check/approval pipeline is a clear niche with distinct install-specific triggers, unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (506 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: anthropics/claude-for-legal
Path: legal-builder-hub/skills/skill-installer/SKILL.md
Commit: 4a6c651

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.